How to Get Bare-Metal GPU Performance in Confidential VMs (thenewstack.io)

At OpenInfra Summit Europe 2025 NVIDIA outlined a reference architecture for running sensitive AI workloads with bare‑metal GPU performance inside confidential VMs by combining Kata Containers (micro‑VMs) with hardware-backed memory encryption and attestation (e.g., SEV/TDX). The goal is to preserve Kubernetes workflows and the driver/libraries/device mapping parity of bare metal while preventing cloud operators from inspecting guest memory. Attestation is central: only after cryptographic proof that a VM’s boot/guest state matches an expected configuration are keys/secrets released, enabling a full‑stack trust model across control plane, nodes and pods. Technically, NVIDIA leverages the GPU Operator and Container Device Interface (CDI) to present GPUs to Kata guests as if on bare metal, supporting PCIe pass‑through, SR‑IOV, GPUDirect RDMA and per‑pod runtime choices (PF pass‑through vs. SR‑IOV). The trick is PCIe topology and peer‑to‑peer DMA; NVIDIA’s Virtualization Reference Architecture (VRA) offers two modes—flatten the hierarchy for simpler provisioning, or replicate host PCIe/IOMMU topology inside the guest (preserving ATS/ACS) to retain P2P behavior. They propose IOMMU grouping workarounds, selective root‑port mapping, and plan upstream collaboration with Red Hat, IBM and the Kata community. NVIDIA cautioned this isn’t a silver bullet—VM breakout risks remain—but the stack materially reduces exposure of models and data while enabling scalable, high‑performance confidential AI deployments.